Enterprise QoS Solution Reference Network Design Guide

Chapter 4 Branch Router QoS Design
NBAR Versus Sasser
Version 3.3
Branch Router LAN Edge QoS Design
By default, the NBAR exchange PDLM is mapped to TCP port 135; therefore, this PDLM can be used
as part of the MS Blaster worm policy definition. Similarly, the NBAR netbios PDLM is bound by
default to TCP/UDP port 139 (in addition to TCP port 137 and UDP ports 137 and 138), so this PDLM
also can be used within the policy definition; specifically, the netbios PDLM can have its port mapping
expanded to include TCP port 445 and UDP ports 135, 139, and 445, as shown in Example 4-15.
Note Alternatively, a custom PDLM can be defined for these ports (TCP/UDP 135, 139, and 445), but before
this could be done, you would have to map the exchange and netbios PDLMs ports away from their
defaults, to avoid conflicting PDLM port mappings.
Example 4-15 NBAR Policies to Identify RPC DCOM/W32/MS Blaster
!
ip nbar port-map netbios tcp 137 139 445 ! Matches TCP 137/139/445
ip nbar port-map netbios udp 135 137 138 139 445 ! Matches UDP 135/137-139/445
!
class-map match-any MS-BLASTER
match protocol exchange ! Matches TCP port 135
match protocol netbios ! Matches MS Blaster NetBIOS PDLM
!
Verification commands:
show policy
show ip nbar port-map
The next major worm after MS Blaster was the Sasser worm (and variants Sasser.A/B/C/D), which was released
in late April 2004. Sasser exploits a flaw in the Windows Local Security Authority Service Server
(LSASS) that can cause systems to crash and continually reboot, or allow a remote attacker to execute
arbitrary code with local system privileges.
Sasser is very efficient in scanning: It can scan 1024 separate IP addresses simultaneously (on TCP port
445). When scanning reveals a vulnerable system, the worm exploits the LSASS vulnerability and
creates a remote shell (RSH) session on TCP port 9996 back to the infecting system. Then Sasser starts
an FTP server on TCP port 5554 to retrieve a copy of the worm.
Sasser can be identified through a custom NBAR PDLM listening for communication on TCP ports 445,
5554, and 9996, as shown in Example 4-16.
Note If TCP port 445 already has been bound to the netbios NBAR PDLM (as recommended previously in
the MS Blaster worm definition), it is not necessary to include this port in the Sasser custom PDLM port
mapping (because it will cause a conflict).
Example 4-16 NBAR Policies to Identify Sasser
!
ip nbar port-map custom-03 tcp 445 5554 9996 ! Matches on TCP 445/5554/9996
!
class-map match-all SASSER
match protocol custom-03 ! Matches Sasser custom PDLM
!
Enterprise QoS Solution Reference Network Design Guide
4-19